Recently, the scale of computer systems has been expanding and the computer systems have become more complicated by mutually connecting information processing units for, for example, a plurality of storage systems to the computer systems via a network.
If the configuration of an information processing unit is set or changed, an administrator of a computer system needs to check information indicating the content of the setting or change (setting information); and if a failure occurs in the information processing unit, the administrator needs to check information indicating the content of the failure (failure information). Examples of a method for the administrator of the computer system for checking the setting information and the failure information include a method of referring to an audit log and a method of referring to event information reported based on the setting or change of the configuration information and the occurrence of a failure.
However, generally, the audit log is often some kind data indicating an operation history of the information processing unit which has been accumulated as text data, so that it is hard to understand the detained setting content of the configuration information. Also, it is difficult to understand the relationship between the information processing units only from the audit log, so that the administrator cannot manage the computer system in consideration of the mutual influence upon the information processing units in the entire computer system by the method of only referring to the audit log.
On the other hand, PTL 1 discloses a management apparatus capable of executing analysis processing efficiently by using a working memory of a constant size as an example of a technique to provide the administrator with event information. The management apparatus disclosed in PTL 1 is characterized in that it divides one or more previously defined rules into one or more rule segments, each of which is composed of conditions and conclusions constituting the relevant rules and stores, and the rule segments obtained as a result of the division are stored in a secondary storage device; and when receiving an event notice from an information processing unit, the management apparatus selects one or more related rule segments, constructs a rule analysis network indicating the relationship between the rules in the relevant memory by coupling the one or more selected rule segments in the memory as necessary, derives an inference based on the constructed rule analysis network, and deletes the rule segments, which can be hardly used for derivation of the inference, from the memory, thereby maintaining a constant working memory size regardless of the number of defined events and the number of rules for the target system and implementing efficient analysis processing.
Furthermore, for example, PTL 2 discloses an event notification system that can be restored by an administrator promptly when a failure occurs. The event notification system disclosed in PTL 2 is characterized in that it detects the occurrence of a specified event (various events such as the occurrence of a failure) from the status of a management system by immediately preparing e-mail from the status of process parameters and notifying the administrator of the specified event, reports the event promptly and accurately by using e-mail, and supports appropriate and easy operations for this event.